CVE-2026-114663— Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments
Quick assessment
Affected
vyperlang vyper
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Vyper 0.4.0b1 至 0.5.0b1 版本在编译不可展开的常量以及从导入模块中省略的默认参数时出现错误。其根本原因在于 在调用函数的作用域中解析这些名称，而非在声明处解析。当合约的参数、局部变量或循环变量与上述名称冲突时，攻击者可操控的输入能够替换预期值，包括针对 uint8 等窄类型的越界值，从而破坏验证逻辑或会计逻辑。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114663
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments
Source: CVE Program / CVE List V5
Vulnerability Description
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用不正确的解析名称或索引
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-114663
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114663
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-114663 (2)
IV. Related Vulnerabilities
Same product: vyper
-
CVE-2026-114118
Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Val -
CVE-2026-114117
Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg. -
CVE-2026-114116
Vyper through 0.5.0b1 Literal Value Manipulation via Line Se -
CVE-2026-114114
Vyper through 0.5.0b1 Literal Value Substitution via Multi-b -
CVE-2026-114115
Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Neste
Same vendor: vyperlang
-
CVE-2026-114118
Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Val -
CVE-2026-114117
Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg. -
CVE-2026-114116
Vyper through 0.5.0b1 Literal Value Manipulation via Line Se -
CVE-2026-114114
Vyper through 0.5.0b1 Literal Value Substitution via Multi-b -
CVE-2026-114115
Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Neste
Same weakness: CWE-706
-
CVE-2026-14288
Use of Incorrectly-Resolved Name or Reference in GitLab -
CVE-2026-112909
filelock: UnixFileLock truncates and chmods any regular file -
CVE-2026-92262
MariaDB: Numerous issues caused by historical #mysql50# tabl -
CVE-2026-61844
FileRise: Folder Metadata Filename Collisions Bypass "read_o -
CVE-2026-110156
Chrome <155.0.8059.79 扩展扩展错误引用解析漏洞
V. Comments for CVE-2026-114663
No comments yet